Privacy Policy

The controller is BIGBRO LLC, 1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110, United States. Privacy enquiries and rights requests may be sent to info@bigbrollc.com.

This policy covers this corporate website, the storefronts we operate under our brand names, our order fulfilment and customer support, and our marketing activity. It does not cover third-party sites we link to, which have their own policies.

We collect data you give us, data generated by your use of our sites, and data we receive from service providers.

• Identity and contact data: name, email address, telephone number, billing and delivery address.
• Order data: items purchased, order value, order and delivery status, correspondence about your order, returns and refunds.
• Payment data: the payment method type, the last four digits of the card, the authorisation result and the billing descriptor. We do not receive or store full card numbers or security codes.
• Customer support data: messages, attachments and photographs you send us, and our replies.
• Technical data: IP address, device and browser type, operating system, language, referring pages, pages viewed and interaction events.
• Marketing data: subscription status, preferences, and engagement with our emails.
• Customs data: where required for international delivery, the identifiers a customs authority demands from the importer of record.

We use personal data to accept and fulfil orders, take payment, arrange delivery and customs clearance, handle returns, refunds and warranty matters, provide customer support, prevent fraud and abuse, meet accounting, tax and consumer law obligations, improve our products and sites, and send marketing where permitted.

Where the GDPR applies, our legal bases are: performance of a contract for order fulfilment and support; legal obligation for tax, accounting and consumer law records; legitimate interests for fraud prevention, site security, analytics and service improvement; and consent for non-essential cookies and for marketing where consent is required. Consent may be withdrawn at any time without affecting prior processing.

We use strictly necessary cookies to operate the cart, checkout and security functions, and, subject to consent where required, analytics and advertising cookies to understand how our stores are used and to measure campaigns.

You can manage non-essential cookies through the consent banner where it is shown, and through your browser settings. Blocking strictly necessary cookies will prevent checkout from working. We honour Global Privacy Control signals where legally required.

We do not sell personal data for money. We share it only with the categories of recipient below, under contract and only as needed:

• E-commerce platform and hosting providers, including Shopify Inc. and Shopify International Limited.
• Payment providers and their processors, including Shopify Payments, for authorisation, settlement, refunds and chargebacks.
• Carriers, freight forwarders and customs brokers, for delivery and import clearance.
• Fulfilment and warehouse partners.
• Email, messaging, analytics and advertising providers.
• Fraud prevention, identity verification and risk screening providers.
• Professional advisers, auditors, insurers and, where required, law enforcement and regulators.
• A buyer or successor in the event of a merger, acquisition or sale of assets.

We are established in the United States, and our service providers operate in the United States, the European Union and other countries. Personal data is therefore transferred outside your country of residence.

For transfers from the EU, EEA, Switzerland or the UK, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, together with supplementary technical and organisational measures. A copy of the relevant safeguards can be requested from us.

Order, invoicing and tax records are retained for the period required by applicable accounting and tax law, generally seven years from the end of the relevant financial year.

Customer support correspondence is retained for up to three years, marketing records until you unsubscribe and for a short suppression period afterwards, and technical logs for up to two years. Data no longer required is deleted or irreversibly anonymised.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls on a need-to-know basis, restricted administrative access, vendor due diligence and logging.

No transmission or storage method is completely secure. Where a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority and, where required, affected individuals.

Subject to conditions in applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests or to direct marketing at any time.

Requests should be sent to info@bigbrollc.com. We respond within one month, extendable by two further months for complex requests, and we may ask for information to verify your identity. You also have the right to lodge a complaint with your local data protection supervisory authority.

Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws may request to know the categories and specific pieces of personal information collected, to delete it, to correct it, and to opt out of sale, sharing or targeted advertising. We do not discriminate against those who exercise these rights.

We do not sell personal information for monetary consideration. Certain advertising cookies may constitute sharing for cross-context behavioural advertising, and you may opt out through our cookie controls or by contacting us. Authorised agents may submit requests with proof of authorisation.

We send marketing email only where we have consent or where an existing customer relationship permits it under applicable law. Every message includes an unsubscribe link, and unsubscribing does not affect service messages about your orders.

Our sites and products are not directed at children under sixteen (16), and we do not knowingly collect their personal data. Where we learn that we have, we delete it. A parent or guardian may contact us to request deletion.

We use automated fraud and risk screening on orders. An order may be delayed or declined as a result. No decision producing legal or similarly significant effects is taken solely by automated means without human review, and you may ask us to review any declined order.

We may update this policy to reflect changes in our processing, our providers or applicable law. The version published on this page is the version in force, and the effective date is shown alongside this document. Material changes are communicated by email where we hold your address.